Add a new e2e test; fix some bugs/usability problems

Mostly addresses #3. Needs more checking, still.
Not sure when it was put in, but `--allowed` isn't a repeated field like this and the last one wins silently.

To do what you want here, do `--allowed tcp:80,tcp:8080`.

(I remember bikeshedding on this mini-syntax back in the day)